Last year, they promised to create an add-on that triggered when you visited sites known to have been breached in the past, and let the user check if his password was included in the leaked data, via HIBP. Mozilla has wasted a bunch of resources creating a pointless tool. A larger horizontal scale has no impact on the security, see ciphered communication: an encrypted message doesn't get less secure if more eyes see it, its security only depends on how well the encryption works.Īssuming that 1Password doesn't use 'security by obscurity', increasing its footprint on the web will not decrease its security. Reducing the horizontal scale is known as 'security by obscurity' and it's a very bad idea to use it.

The evaluation of the 'attack surface' here refers to the horizontal scale (how many actors of the same type see the interface) whereas the concept of reducing the 'attack surface' refers to the vertical scale (how many types of communication the actors see). > chances are they're increasing attack surface in both directions (ie making compromise of 1Password more likely too). As a result, the Firefox users have better tools to manage password-based authentication, increasing their security. HIBP and 1Password have very good track records of mitigating attacks on user passwords (by notifying people about password breaches and thus decreasing the value of a password breach, and by making easy for the average user to manage complex passwords). I tend to evaluate a security in context of a threat model. > HIBP and 1Password aren't making FF more secure, meaning we don't know, but lets put this out there) So adding a feature that helps people be more secure against a specific threat (using bad passwords that have been broken) makes the product less secure? This makes no sense, but it's just put in there to spread Fear (FF is less secure because of added security features) and Doubt ('could in theory'. > That could in theory make it less secure

Thus this is a net addition, and not to the detriment of other work Troy Hunt) wouldn't had the skills or inclination to bring other enhancements to Firefox.

The problem here is that this is not a zero-sum game: the people that worked on this (e.g. It's like saying - if we wouldn't spend money on the space program, we could feed Africa with that money.

Arguably, if Firefox is devoting resources to this then it's not got resources to spend on other issues.

1password firefox extension